Operation management apparatus, operation management method, and program

ABSTRACT

In the invariant analysis, a fault cause is judged correctly. A correlation model storing unit (112) of an operation management apparatus (100) stores a correlation model including one or more correlation functions each of which indicates a correlation between two metrics different each other among a plurality of metrics in a system. The correlation destruction detecting unit (103) detects correlation destruction of the correlation which is included in the correlation model by applying newly inputted values of the plurality of metrics to the correlation model. The abnormality calculation unit (104) calculates and outputs a centrality degree which indicates a degree to which a first metric is estimated to be center of distribution of correlation destruction on the basis of a correlation destruction degree of one or more correlations between each of one or more second metrics having a correlation with the first metric and each of one or more metrics other than the first metric among the plurality of metrics.

CROSS REFERENCE TO RELATED APPLICATIONS

This present application is a continuation application of U.S. patentapplication Ser. No. 14/372,254 filed on Jul. 15, 2014, which is aNational Stage Entry of PCT/JP2013/000264 filed on Jan. 22, 2013, whichclaims the benefit of priority from Japanese Patent Application2012-011076 filed on Jan. 23, 2012, the disclosures of all which areincorporated in their entirety by reference herein.

TECHNICAL FIELD

The present invention relates to an operation management apparatus, anoperation management method and a program thereof, and in particular,relates to an operation management apparatus, an operation managementmethod and a program thereof which detect a fault of a system.

BACKGROUND ART

Patent literature 1 discloses an example of an operation managementsystem which generates a model of a system by using time-seriesinformation on system performance, and detects a fault of the system byusing the generated model.

The operation management system described in the patent literature 1determines a correlation function for each of combinations among aplurality of metrics (performance indexes) of a system on the basis ofmeasurement values of the plurality of metrics, and generates acorrelation model including a plurality of correlation functions each ofwhich indicates a correlation. Then, the operation management systemdetects destruction of the correlation (correlation destruction) on thebasis of newly inputted measurement values of the metrics by using thegenerated correlation model, and judges a fault cause on the basis ofthe detected correlation destruction. The above-mentioned art to analyzea fault cause on the basis of the correlation destruction is called aninvariant analysis.

CITATION LIST Patent Literature

[Patent literature 1] Japanese Patent Application Laid-Open No.2009-199533

SUMMARY OF INVENTION Technical Problem

According to the invariant analysis disclosed in the above-mentionedpatent literature 1, for each of metrics, number or a ratio ofcorrelations on which correlation destruction is detected out ofcorrelation functions between the metric and each of the other metricsis calculated as an abnormality degree. Then, a fault cause is judged onthe basis of the abnormality degree. However, there is a case that it isimpossible to judge the fault cause correctly depending on the situationwhether a correlation between the metrics exists or not, or number ofcorrelations which each metric has.

FIGS. 10 to 13 are diagrams showing an example of a result ofcalculating the abnormality degree in the invariant analysis of patentliterature 1. Here, each node indicates a metric, and an arrow betweenmetrics indicates a correlation from one to the other out of twometrics. A node circled by a bold line indicates a metric related to amonitored apparatus or a resource having a fault cause (fault causingmetric), and an arrow described by a bold line indicates a correlationon which correlation destruction is detected. A number written in aparenthesis and assigned to each node indicates an abnormality degree ofthe metric. In FIG. 10 and FIG. 12, due to a fault related to a metricSV1, correlation destruction is caused between the metric SV1 and theother metric. In FIG. 11 and FIG. 13, due to a fault related to a metricSV2, correlation destruction is caused between the metric SV2 and themetric SV1.

Each of FIG. 10 and FIG. 11 exemplifies a case that the number ofcorrelations on which correlation destruction is detected is used as theabnormality degree. For example, in the case of FIG. 10, since theabnormality degree of the metric SV1 is large (abnormality degree=4), itis possible to judge that the metric SV1 has the fault cause. On theother hand, in the case of FIG. 11, since the abnormality degrees of themetrics SV1 and SV2 are identical each other (abnormality degree=1), itis impossible to judge which of the metrics SV1 and SV2 has the faultcause. As mentioned above, in the case that the number of correlationson which correlation destruction is detected is used as the abnormalitydegree, there is a case that it is impossible to judge a fault causecorrectly due to influence of correlation destruction which is caused bythe other fault as shown in FIG. 11 or influence of correlationdestruction which is caused by an incidental noise.

Each of FIG. 12 and FIG. 13 exemplifies a case that a ratio of thecorrelation on which the correlation destruction is detected is used asthe abnormality degree. For example, in the case of FIG. 12, since theabnormality degree of metrics SV1 to SV5 are identical each other(abnormality degree=1.0), it is impossible to judge which of the metricsSV1 to SV5 has the fault cause. On the other hand, in the case of FIG.13, since the abnormality degree of the metric SV2 (abnormalitydegree=1.0) is larger than the abnormality degree of the metric SV1(abnormality degree=0.25), it is possible to judge that the metric SV2has the fault cause. As mentioned above, in the case that the ratio ofthe correlation on which the correlation destruction is detected is usedas the abnormality degree, it is possible to improve the problem whichis caused in the case that the number of the correlation is used as theabnormality degree. However, as shown in FIG. 12, there is a case thatit is impossible to judge a fault cause correctly depending on thenumber of the correlations of each metric.

An object of the present invention is to solve the above-mentionedproblem, and specifically to provide an operation management apparatus,an operation management method, and a program thereof which are able tojudge a fault cause correctly in the invariant analysis.

Solution to Problem

An operation management apparatus according to an exemplary aspect ofthe invention includes: a correlation model storing means for storing acorrelation model including one or more correlation functions each ofwhich indicates a correlation between two metrics different each otheramong a plurality of metrics in a system; a correlation destructiondetecting means for detecting correlation destruction of the correlationwhich is included in the correlation model by applying newly inputtedvalues of the plurality of metrics to the correlation model; and anabnormality calculation means for calculating and outputting acentrality degree which indicates a degree to which a first metric isestimated to be center of distribution of correlation destruction on thebasis of a correlation destruction degree of one or more correlationsbetween each of one or more second metrics having a correlation with thefirst metric and each of one or more metrics other than the first metricamong the plurality of metrics.

An operation management method according to an exemplary aspect of theinvention includes: storing a correlation model including one or morecorrelation functions each of which indicates a correlation between twometrics different each other among a plurality of metrics in a system;detecting correlation destruction of the correlation which is includedin the correlation model by applying newly inputted values of theplurality of metrics to the correlation model; and calculating andoutputting a centrality degree which indicates a degree to which a firstmetric is estimated to be center of distribution of correlationdestruction on the basis of a correlation destruction degree of one ormore correlations between each of one or more second metrics having acorrelation with the first metric and each of one or more metrics otherthan the first metric among the plurality of metrics.

A computer readable storage medium according to an exemplary aspect ofthe invention, records thereon a program, causing a computer to performa method comprising: storing a correlation model including one or morecorrelation functions each of which indicates a correlation between twometrics different each other among a plurality of metrics in a system;detecting correlation destruction of the correlation which is includedin the correlation model by applying newly inputted values of theplurality of metrics to the correlation model; and calculating andoutputting a centrality degree which indicates a degree to which a firstmetric is estimated to be center of distribution of correlationdestruction on the basis of a correlation destruction degree of one ormore correlations between each of one or more second metrics having acorrelation with the first metric and each of one or more metrics otherthan the first metric among the plurality of metrics.

Advantageous Effect of Invention

An effect of the present invention is that it is possible to judge afault cause correctly in the invariant analysis.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a block diagram showing a characteristic configuration of afirst exemplary embodiment of the present invention.

FIG. 2 is a block diagram showing a configuration of an operationmanagement system which includes an operation management apparatus 100,in the first exemplary embodiment of the present invention.

FIG. 3 is a flowchart showing a process, which is carried out by theoperation management apparatus 100, in the first exemplary embodiment ofthe present invention.

FIG. 4 is a diagram showing an example of a correlation model 122, inthe first exemplary embodiment of the present invention.

FIG. 5 is a diagram showing an example of detecting correlationdestruction and calculating an abnormality degree, in the firstexemplary embodiment of the present invention.

FIG. 6 is a diagram showing another example of detecting correlationdestruction and calculating an abnormality degree, in the firstexemplary embodiment of the present invention.

FIG. 7 is a diagram showing an example of a result of calculating anabnormality degree, in the first exemplary embodiment of the presentinvention.

FIG. 8 is a diagram showing another example of a result of calculatingan abnormality degree, in the first exemplary embodiment of the presentinvention.

FIG. 9 is a diagram showing an example of an analysis result 130, in thefirst exemplary embodiment of the present invention.

FIG. 10 is a diagram showing an example of a result of calculating anabnormality degree, in the invariant analysis of patent literature 1.

FIG. 11 is a diagram showing another example of a result of calculatingan abnormality degree, in the invariant analysis of patent literature 1.

FIG. 12 is a diagram showing another example of a result of calculatingan abnormality degree, in the invariant analysis of patent literature 1.

FIG. 13 is a diagram showing another example of a result of calculatingan abnormality degree, in the invariant analysis of patent literature 1.

DESCRIPTION OF EMBODIMENTS

(First Exemplary Embodiment)

Next, a first exemplary embodiment of the present invention will bedescribed.

Firstly, a configuration according to the first exemplary embodiment ofthe present invention will be described. FIG. 2 is a block diagramshowing a configuration of an operation management system which includesan operation management apparatus 100, in the first exemplary embodimentof the present invention.

Referring to FIG. 2, the operation management system in the firstexemplary embodiment of the present invention includes the operationmanagement apparatus 100, and one or more monitored apparatuses 200. Theoperation management apparatus 100 and the monitored apparatus 200 areconnected each other through a network.

The monitored apparatus 200 is an apparatus, which is a component of asystem, such as a Web server, a Database server.

The monitored apparatus 200 measures actual data (measurement value) onperformance values of plural items of the monitored apparatus 200 at aperiodical interval, and sends the measurement data to the operationmanagement apparatus 100. As the item of the performance value, a rateof using a computer resource or an amount of usage of the computerresource such as, for example, a rate of using CPU (Central ProcessingUnit), a rate of using a memory, a rate of accessing a disk is used.

Here, a set of the monitored apparatus 200 and the item of theperformance value is defined as a metric (performance index), and a setof values of the plural metrics measured at the same time is defined asperformance information. The metric is expressed by a numerical value ofan integer or a decimal. The metric is corresponding to the elementwhich is described in patent literature 1.

The operation management apparatus 100 generates, on the basis of theperformance information collected from the monitored apparatus 200 whichis a monitoring target, a correlation model 122 with respect to themonitored apparatus 200. Then, the operation management apparatus 100detects a fault or abnormality of the monitored apparatus 200 by usingthe generated correlation model 122.

The operation management apparatus 100 includes a performanceinformation collecting unit 101, a correlation model generation unit102, a correlation destruction detecting unit 103, an abnormalitycalculation unit 104, a display unit 105, a performance informationstoring unit 111, a correlation model storing unit 112, and acorrelation destruction storing unit 113.

The performance information collecting unit 101 collects the performanceinformation from the monitored apparatus 200, and stores time seriesvariation of the performance information in the performance informationstoring unit 111 as sequential performance information 121.

The correlation model generation unit 102 generates the correlationmodel 122 of the system including the monitored apparatus 200, on thebasis of the sequential performance information 121.

Here, the correlation model 122 includes, for each combination of twometrics in a plurality of metrics, a correlation function (ortransformation function) indicating a correlation between the twometrics. The correlation function is a function which estimates, fromtime series of one metric value, time series of other metric values. Thecorrelation model generation unit 102 determines a coefficient of thecorrelation function for each combination of the metrics on the basis ofthe sequential performance information 121 which is collected for apredetermined modeling time period. Similarly to the case of theoperation management apparatus described in patent literature 1, thecoefficient of the correlation function is determined in a systemidentification process which is carried out to the time-series ofmeasurement values of the metrics.

Note that, similarly to the case of the operation management apparatusdescribed in patent literature 1, the correlation model generation unit102 may calculate a weight of the correlation function for eachcombination of the metrics, and may generate a set of the correlationfunctions which have the weights equal to or larger than a predeterminedvalue as the correlation model 122.

The correlation model storing unit 112 stores the correlation model 122generated by the correlation model generation unit 102.

FIG. 4 is a diagram showing an example of the correlation model 122, inthe first exemplary embodiment of the present invention. In FIG. 4, thecorrelation model 122 is expressed by a graph which includes a node andan arrow. Here, each node indicates a metric, and the arrow between themetrics indicates a correlation from one to the other out of the twometrics. A correlation function is determined for each of thecorrelations.

According to the correlation model 122 shown in FIG. 4, one metricexists in each of the monitored apparatuses 200 which have apparatusidentifiers SV1 to SV5 respectively (hereinafter, referred to as metricsSV1 to SV5 respectively), and the correlation is indicated for eachcombination of two metrics out of the metrics SV1 to SV5.

Similarly to the case of the operation management apparatus described inpatent literature 1, the correlation destruction detecting unit 103detects correlation destruction of the correlations included in thecorrelation model 122, on the basis of the performance informationinputted newly.

Here, similarly to the description of patent literature 1, thecorrelation destruction detecting unit 103 calculates, through inputtinga measurement value of one metric out of two metrics of the pluralmetrics into the correlation function corresponding to the two metrics,an estimation value of the other metric. In the case that a differencebetween the estimation value and a measurement value of the other metric(transformation error caused by the correlation function) is equal to orlarger than a predetermined value, the correlation destruction detectingunit 103 detects it as the correlation destruction of the correlationbetween the two metrics.

The correlation destruction storing unit 113 stores correlationdestruction information 123 indicating correlations on which correlationdestruction is detected.

Each of FIG. 5 and FIG. 6 is a diagram showing an example of detectingcorrelation destruction and calculating an abnormality degree, in thefirst exemplary embodiment of the present invention. In FIG. 5 and FIG.6, an arrow expressed by a bold line indicates a correlation on whichcorrelation destruction is detected on the correlation model 122 shownin FIG. 4. In FIG. 5, a node expressed by a bold line indicates a metricof the monitored apparatus 200 which has a fault cause (fault causingmetric). According to the example shown in FIG. 5, due to the fault ofthe monitored apparatus 200 having the apparatus identifier SV1,correlation destruction is caused on the correlation functions betweenthe metric SV1 and each of the metrics SV2 to SV5. According to theexample shown in FIG. 6, due to the fault of any of the monitoredapparatuses 200 having the apparatus identifiers SV2 to SV5, or a noisewhich intermingles with the measurement values of the metrics,correlation destruction is caused on each of correlation functions.

The abnormality calculation unit 104 calculates an abnormality degree ofeach metric on the basis of distribution of correlation destruction onthe correlation model 122. Hereinafter, the method of calculating theabnormality degree will be described with reference to FIG. 5 and FIG.6.

As shown in FIG. 5, in the case that a fault is caused on the monitoredapparatus 200 or the resource, abnormality is caused on the metric(fault causing metric) related to the monitored apparatus 200 and theresource. Consequently, correlation destruction is caused oncorrelations between the fault causing metric and metrics having acorrelation with the fault causing metric (adjacent metrics). Here, as acorrelation destruction degree of the correlation function between ametric (first metric, SV1 in this case) and each of adjacent metrics(second metrics, SV2 to SV5 in this case) to the first metric is high,it is estimated that the possibility that the metric is corresponding tothe fault causing metric is high.

Moreover, due to spread of the fault, abnormalities are caused on theadjacent metrics to the fault causing metric and other metrics.Consequently, correlation destruction may be caused on correlationsbetween each of the adjacent metrics and each of the other metrics.However, it is assumed that a possibility that correlation destructionis caused between each of the adjacent metrics and each of the othermetrics is lower than a possibility that correlation destruction iscaused between the fault causing metric and each of the adjacentmetrics. In this case, the correlation destruction is distributedcentering around the fault causing metric on the correlation model 122.Accordingly, as shown in FIG. 5, in the case that number of corruptedcorrelations among the correlations between each of adjacent metrics(second metrics, SV2 to SV5 in this case) to a metric (first metric, SV1in this case) and each of metrics other than the first metric is small,that is, in the case that the first metric exists in a center of thedistribution of the correlation destruction, it is estimated that thepossibility that the first metric is corresponding to the fault causingmetric is high.

Moreover, as shown in FIG. 6, in the case that number of corruptedcorrelations among the correlations between each of adjacent metrics(second metrics, SV2 to SV5 in this case) to a metric (first metric, SV1in this case) and each of metrics other than the first metric is large,that is, in the case that the first metric does not exist in a center ofthe distribution of the correlation destruction, it is estimated thatthe possibility that the first metric is corresponding to the faultcausing metric is low.

The abnormality calculation unit 104 calculates a degree of destructionof a correlation (a correlation destruction degree) and a degree ofexisting in the center of distribution of the correlation destruction (acentrality degree) for each metric, and calculates an abnormality degreeon the basis of the correlation destruction degree and the centralitydegree.

The abnormality calculation unit 104 calculates the correlationdestruction degree, for example, by using Equation 1.

$\begin{matrix}{ {{correlation}\mspace{14mu}{destruction}\mspace{14mu}{degree}} ) = \frac{N_{d\; 0}}{N_{0}}} & \lbrack {{Equation}\mspace{14mu} 1} \rbrack\end{matrix}$

Here, N₀ is number of the correlations which a target metric forcalculating the abnormality degree has, and N_(d0) is number of thecorrelations on which correlation destruction is detected out of thecorrelations which the target metric has.

For example, in the case of FIG. 5, the abnormality calculation unit 104obtains the correlation destruction degree 1.0 for the metric SV1. Inthe case of FIG. 6, the abnormality calculation unit 104 also obtainsthe correlation destruction degree 1.0 for the metric SV1.

The abnormality calculation unit 104 calculates the centrality degree,for example, by using Equation 2.

$\begin{matrix}{ {{centrality}\mspace{14mu}{degree}} ) = \{ {{\begin{matrix}{1 - {\frac{N_{d}}{N}\mspace{14mu}\ldots\mspace{14mu}( {N \neq 0} )}} \\{1\mspace{14mu}\ldots\mspace{14mu}( {N = 0} )}\end{matrix}N} = {{\sum\limits_{i = 1}^{n}{N_{i}N_{d}}} = {\sum\limits_{i = 1}^{n}N_{di}}}} } & \lbrack {{Equation}\mspace{14mu} 2} \rbrack\end{matrix}$

Here, n is number of the metrics (adjacent metrics) having a correlationwith the target metric for calculating the abnormality degree. N_(i) isnumber of correlations between an i'th adjacent metric and each of themetrics other than the target metric, and N_(di) is number ofcorrelations on which correlation destruction is detected out of thecorrelations between the i'th adjacent metric and each of the metricsother than the target metric.

For example, in the case of FIG. 5, the abnormality calculation unit 104obtains the centrality degree 1.0 for the metric SV1. In the case ofFIG. 6, the abnormality calculation unit 104 obtains the centralitydegree 0 for the metric SV1.

Furthermore, the abnormality calculation unit 104 calculates theabnormality degree, for example, by using Equation 3.abnormality degree)=(correlation destruction degree)+(centralitydegree)  [Equation 3]

For example, in the case of FIG. 5, the abnormality calculation unit 104obtains the abnormality degree 2.0 for the metric SV1. In the case ofFIG. 6, the abnormality calculation unit 104 obtains that theabnormality degree 1.0 for the metric SV1.

Note that, as long as the correlation destruction degree of thecorrelation functions which the target metric has is calculated, theabnormality calculation unit 104 may calculate the correlationdestruction degree not only by using Equation 1 but also by anothermethod. For example, the abnormality calculation unit 104 may calculatethe correlation destruction degree on the basis of number of thecorrelations on which correlation destruction is detected out of thecorrelations which the target metric has, or on the basis of an amountof a transformation error caused by the correlation function which thetarget metric has.

Moreover, as long as the degree of existing in the center of thedistribution of correlation destruction for the target metric iscalculated, the abnormality calculation unit 104 may calculate thecentrality degree not only by using Equation 2 but also by anothermethod. For example, the abnormality calculation unit 104 may calculatethe centrality degree on the basis of number of the correlations onwhich correlation destruction is detected out of the correlations whichthe adjacent metrics have, or on the basis of an amount of atransformation error caused by the correlation function which theadjacent metrics have. Furthermore, the abnormality calculation unit 104may calculate the centrality degree of, not only the distribution of thecorrelation destruction related to the adjacent metrics, but alsodistribution of correlation destruction detected in a range of apredetermined number of correlation functions from the target metric onthe correlation model 122, or distribution of correlation destructiondetected on a whole of the correlation model 122.

Moreover, as long as high abnormality degree is obtained as correlationdestruction degree increases or centrality degree increases, theabnormality calculation unit 104 may calculate the abnormality degreenot only by Equation 3 but also by another method. For example, theabnormality calculation unit 104 may calculate the abnormality degreethrough multiplying the correlation destruction degree by the centralitydegree.

The abnormality calculation unit 104 outputs an analysis result 130including the calculated correlation destruction degree, centralitydegree, and abnormality degree. The display unit 105 displays theanalysis result 130. Here, the abnormality calculation unit 104 mayoutput the analysis result 130 as a file.

Note that the operation management apparatus 100 may be a computer whichincludes CPU and a storage medium storing a program and which operatesin accordance with control of the program. Moreover, the performanceinformation storing unit 111, the correlation model storing unit 112 andthe correlation destruction storing unit 113 may be configured byrespective storage media or may be configured by one storage medium.

Next, operation of the operation management apparatus 100 in the firstexemplary embodiment of the present invention will be described.

FIG. 3 is a flowchart showing a process, which is carried out by theoperation management apparatus 100, in the first exemplary embodiment ofthe present invention.

Firstly, the performance information collecting unit 101 of theoperation management apparatus 100 collects performance information fromthe monitored apparatus 200, and stores the collected performanceinformation in the performance information storing unit 111 (Step S101).

The correlation model generation unit 102 refers to the sequentialperformance information 121 stored in the performance informationstoring unit 111, and generates a correlation model 122 on the basis ofthe performance information collected during a predetermined modelingperiod which is designated by a manager or the like, and stores thecorrelation model 122 in the correlation model storing unit 112 (StepS102).

Each of FIG. 7 and FIG. 8 is a diagram showing an example of a result ofcalculating an abnormality degree, in the first exemplary embodiment ofthe present invention. The correlation model 122 and the detectingsituation of the correlation destruction shown in FIG. 7 arecorresponding to the correlation model 122 and the detecting situationof the correlation destruction shown in FIG. 10 and FIG. 12, and thecorrelation model 122 and the detecting situation of the correlationdestruction shown in FIG. 8 are corresponding to the correlation model122 and the detecting situation of the correlation destruction shown inFIG. 11 and FIG. 13.

For example, the correlation model generation unit 102 generates thecorrelation model 122 as shown in FIG. 7.

Next, the correlation destruction detecting unit 103 detects correlationdestruction of the correlations included in the correlation model 122,by using performance information collected newly by the performanceinformation collecting unit 101, and generates correlation destructioninformation 123 (Step S103). The correlation destruction detecting unit103 stores the correlation destruction information 123 in thecorrelation destruction storing unit 113.

For example, the correlation destruction detecting unit 103 detectscorrelation destruction as shown in FIG. 7.

Next, the abnormality calculation unit 104 calculates a correlationdestruction degree of each metric by using Equation 1 (Step S104). Theabnormality calculation unit 104 calculates a centrality degree of eachmetric by using Equation 2 (Step S105). The abnormality calculation unit104 calculates an abnormality degree of each metric by using Equation 3(Step S106).

For example, the correlation destruction detecting unit 103 calculatescorrelation destruction degrees, centrality degrees, and abnormalitydegrees as shown in the table of FIG. 7. In FIG. 7, the centralitydegree and the abnormality degree of the metric SV1 are larger than onesof the other metrics. Accordingly, it is judged that the possibilitythat the metric SV1 is a fault causing metric is high.

In the case that the correlation destruction is detected as shown inFIG. 8, abnormality degrees are calculated as shown in the table of FIG.8. In FIG. 8, the centrality degree of each of the metrics SV1 and SV2is larger than one of the other metrics, and the abnormality degree ofthe metric SV2 is larger than one of the other metrics. Accordingly, itis judged that the possibility that the metric SV2 is a fault causingmetric is high.

Next, the abnormality calculation unit 104 outputs the analysis result130 including the calculated correlation destructed degrees, centralitydegrees, and abnormality degrees through the display unit 105 (StepS107).

FIG. 9 is a diagram showing an example of an analysis result 130 in thefirst exemplary embodiment of the present invention. In FIG. 9, theanalysis result 130 includes a correlation-destruction detection result131 and an abnormality degree list 132.

The correlation-destruction detection result 131 indicates thecorrelations on which the correlation destruction is detected on thegraph showing the correlation model 122. According to the example ofFIG. 9, the node corresponding to the metric which has the largecentrality degree is circled by a dotted line, and the nodecorresponding to the metric which has the large abnormality degree isindicated by a black node. The abnormality degree list 132 indicates themetrics related to the correlations on which correlation destruction isdetected, and the correlation destruction degrees, the centralitydegrees, and the abnormality degrees of the metrics. According to theexample of FIG. 9, the metrics related to the correlations on which thecorrelation destruction is detected are shown in an order of largenessof the abnormality degree.

The manager can grasp the monitored apparatus 200 or the resource whichare related to the metric having the large centrality degree and thelarge abnormality degree, as a candidate of a fault cause, by referringto the analysis result 130.

For example, the abnormality calculation unit 104 outputs the analysisresult 130 shown in FIG. 9 for the result of calculating the abnormalitydegrees shown in FIG. 7, to the display unit 105. The manager grasps themonitored apparatus 200 having the apparatus identifier SV1, as acandidate of a fault cause by referring to the analysis result 130 shownin FIG. 9.

Note that the abnormality calculation unit 104 may indicate theidentifier of the monitored apparatus 200 or the resource related to themetric having the largest abnormality degree, as the candidate of thefault cause.

By carrying out the above, the operation of the first exemplaryembodiment of the present invention is completed.

Next, a characteristic configuration of the first exemplary embodimentof the present invention will be described. FIG. 1 is a block diagramshowing a characteristic configuration according to the first exemplaryembodiment of the present invention.

Referring to FIG. 1, an operation management apparatus 100 of the firstexemplary embodiment of the present invention includes a correlationmodel storing unit 112, a correlation destruction detecting unit 103 andan abnormality calculation unit 104.

The correlation model storing unit 112 stores a correlation modelincluding one or more correlation functions each of which indicates acorrelation between two metrics different each other among a pluralityof metrics in a system. The correlation destruction detecting unit 103detects correlation destruction of the correlation which is included inthe correlation model by applying newly inputted values of the pluralityof metrics to the correlation model. The abnormality calculation unit104 calculates and outputs a centrality degree which indicates a degreeto which a first metric is estimated to be center of distribution ofcorrelation destruction on the basis of a correlation destruction degreeof one or more correlations between each of one or more second metricshaving a correlation with the first metric and each of one or moremetrics other than the first metric among the plurality of metrics.

According to the first exemplary embodiment of the present invention, itis possible to judge a fault cause correctly, in the invariant analysis.The reason is that the abnormality calculation unit 104 calculates andoutputs a centrality degree which is a degree to which the first metricis estimated to be center of distribution of correlation destruction onthe basis of a correlation destruction degree of correlations betweeneach of one or more second metrics having a correlation with the firstmetric and each of one or more metrics other than the first metric amongthe plural metrics.

Moreover, according to the first exemplary embodiment of the presentinvention, it is possible to judge a fault cause more correctly, in theinvariant analysis. The reason is that the abnormality calculation unit104 calculates the abnormality degree of the first metric on the basisof a correlation destruction degree of correlations between the firstmetric and each of one or more second metrics, and the calculatedcentrality degree of the first metric.

Moreover, according to the first exemplary embodiment of the presentinvention, it is possible to grasp the center of the distribution ofcorrelation destruction which is used for judging a fault cause, in theinvariant analysis. The reason is that the abnormality calculation unit104 indicates a metric having the large centrality degree on the graphshowing the correlation destruction on the correlation model 122, in theanalysis result 130.

While the invention has been particularly shown and described withreference to exemplary embodiments thereof, the invention is not limitedto these embodiments. It will be understood by those of ordinary skillin the art that various changes in form and details may be made thereinwithout departing from the spirit and scope of the present invention asdefined by the claims.

This application is based upon and claims the benefit of priority fromJapanese Patent Application No. 2012-011076, filed on Jan. 23, 2012, thedisclosure of which is incorporated herein in its entirety by reference.

REFERENCE SIGNS LIST

100 operation management apparatus

101 performance information collecting unit

102 correlation model generation unit

103 correlation destruction detecting unit

104 abnormality calculation unit

105 display unit

111 performance information storing unit

112 correlation model storing unit

113 correlation destruction storing unit

121 sequential performance information

122 correlation model

123 correlation destruction information

130 analysis result

131 correlation-destruction detection result

132 abnormality degree list

200 monitored apparatus

What is claimed is:
 1. A method for detecting abnormality of a system,the method comprising: collecting performance information of a set ofmetrics, each of the metrics in the set being a resource in a computerof the system; detecting correlation destruction based on a correlationmodel and the collected performance information of the set of metrics;calculating a centrality of distribution of correlation destruction fora metric in the set on which the correlation destruction is detected, bycounting a number of correlations for which correlation destruction isdetected with respect to other metrics in the set that are correlatedwith the metric; determining whether an abnormality exists for themetric by comparing centralities of the metrics in the set; responsiveto a determination that the abnormality exists, displaying: a firstmetric of the resource on which the abnormality exists, and a secondmetric related to the first metric, the second metric being detectedbased on the correlation model, wherein the displaying includes:displaying the first metric and the second metric in different forms andin association with each other, indicating that the first metric is ametric causing the correlation destruction and the second metric is ametric related to the correlation destruction; and handling a failurerelated to the first metric, when an indication is inputted in responseto the displaying.
 2. The method according to claim 1, wherein detectingcorrelation destruction includes: detecting the correlation destructionwhen a difference between an estimation value and a measurement value ofone of the metrics is equal to or larger than a predetermined value. 3.The method according to claim 1, wherein displaying the first metricincludes: displaying the first metric in association with theperformance information indicating the abnormality and the secondmetric.
 4. The method according to claim 1, further comprising:calculating a correlation destruction degree; and determining whetherthe abnormality exists further based on the correlation destructiondegree.
 5. A non-transitory computer readable storage medium recordingthereon a program, when executed, causing a computer to perform a methodcomprising: collecting performance information of a set of metrics, eachof the metrics being a resource in a computer of a system; detectingcorrelation destruction based on a correlation model and the collectedperformance information of the set of metrics; calculating a centralityof distribution of correlation destruction for a metric in the set forwhich the correlation destruction is detected, by counting a number ofcorrelations on which correlation destruction is detected with respectto other metrics in the set that are correlated with the metric;determining whether an abnormality exists for the metric by comparingcentralities of the metrics in the set; responsive to a determinationthat the abnormality exists, displaying: a first metric of the resourceon which the abnormality exists, and a second metric related to thefirst metric, the second metric being detected based on the correlationmodel; and wherein the displaying includes: displaying the first metricand the second metric in different forms and in association with eachother, indicating that the first metric is a metric causing thecorrelation destruction and the second metric is a metric related to thecorrelation destruction; and handling a failure related to the firstmetric, when an indication is inputted in response to the displaying. 6.The non-transitory computer readable storage medium according to claim5, wherein detecting correlation destruction includes: detecting thecorrelation destruction when a difference between an estimation valueand a measurement value of one of the metrics is equal to or larger thana predetermined value.
 7. The non-transitory computer readable storagemedium according to claim 5, wherein displaying the first metricincludes: displaying the first metric in association with theperformance information indicating the abnormality and the secondmetric.
 8. The non-transitory computer readable storage medium accordingto claim 5, further comprising: calculating a correlation destructiondegree; and determining whether the abnormality exists further based onthe correlation destruction degree.
 9. A method for detectingabnormality of a system, the method comprising: collecting performanceinformation of a set of metrics, each of the metrics being a resource ina computer of the system; detecting correlation destruction based on acorrelation model and the collected performance information of the setof metrics; calculating a centrality of distribution of correlationdestruction for a metric in the set for which the correlationdestruction is detected, by counting a number of correlations on whichcorrelation destruction is detected with respect to other metrics in theset that are correlated with the metric; determining whether anabnormality exists for the metric by comparing centralities of themetrics; responsive to a determination that the abnormality existsdisplaying: a first metric of the first resource on which theabnormality exists, and a second metric related to the first metric, thesecond metric being detected based on the correlation model andindicating the abnormality exists on a second resource; wherein thefirst metric and the second metric are correlated; and wherein thedisplaying includes: displaying the first metric and the second metricin different forms and in association with each other, indicating thatthe first metric is a metric causing the correlation destruction and thesecond metric is a metric related to the correlation destruction; andhandling a failure related to the first metric, when an indication isinputted in response to the displaying.
 10. The method according toclaim 9, further comprising: calculating a correlation destructiondegree; and determining whether the abnormality exists further based onthe correlation destruction degree.